Medium severity4.1NVD Advisory· Published Oct 9, 2026

CVE-2026-84224

Description

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Kirkillm-fuzzy
Range: <6.3.2
Package: https://wordpress.org/plugins/kirki

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/6a2455dd-8da9-4c7e-a249-3c694cf2983e/nvd

News mentions

No linked articles in our index yet.

cvss	0.267
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000